Open-source AI video localization and dubbing for YouTube/Bilibili: speech recognition, subtitle translation, voice cloning, audio mixing and rendering. 开源 AI 视频翻译配音工具。
This report summarizes scanner evidence for liuzhao1225/YouDub-webui, a Python project with 5,639 GitHub stars. SynthScan examined 32,020 lines of code across 100 source files, recording 459 pattern matches distributed across 7 syntactic categories. The legacy adjusted pattern signal is 14.4 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 363 finding(s).
Are imports declared and package/API names verified? 52 finding(s).
Are wrappers, guards, and repeated structures necessary? 400 finding(s).
Which changes need focused human review? 459 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 459 distinct pattern matches across 7 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | backend/app/auth.py | 107 | def validate_auth_configuration() -> AuthSettings: | CODE |
| LOW | backend/app/config.py | 18 | def configure_windows_ffmpeg_dll_directory() -> None: | CODE |
| LOW | backend/app/config.py | 48 | def _load_runtime_environment(repo_root: Path) -> None: | CODE |
| LOW | backend/app/gpu_memory.py | 76 | def release_after_stage_enabled() -> bool: | CODE |
| LOW | backend/app/database.py | 47 | def _migrate_openai_defaults_to_atlascloud(conn: sqlite3.Connection) -> None: | CODE |
| LOW | backend/app/database.py | 204 | def delete_expired_auth_sessions(expires_before: str) -> int: | CODE |
| LOW | backend/app/database.py | 213 | def reserve_auth_login_attempt( | CODE |
| LOW | backend/app/database.py | 260 | def delete_auth_login_attempt(client_hash: str) -> bool: | CODE |
| LOW | backend/app/database.py | 269 | def backfill_titles_from_metadata() -> None: | CODE |
| LOW | backend/app/pipeline.py | 227 | def _write_uploaded_asr_artifact(self, task: dict) -> Path: | CODE |
| LOW | backend/app/pipeline.py | 283 | def _log_release_report_preserving_error( | CODE |
| LOW | backend/app/pipeline.py | 296 | def _log_messages_preserving_error( | CODE |
| LOW⚡ | backend/app/pipeline.py | 325 | def _log_secondary_release_failure( | CODE |
| LOW | backend/app/main.py | 110 | def normalize_translate_concurrency(value: str) -> str: | CODE |
| LOW | backend/app/main.py | 146 | async def redact_login_validation_error( | CODE |
| LOW | backend/app/main.py | 204 | def _clear_replaced_login_cookie( | CODE |
| LOW | backend/app/devices.py | 104 | def _resolve_configured_device(value: str, setting_name: str) -> str: | CODE |
| LOW | backend/app/devices.py | 145 | def validate_device_available(selected_device: str, setting_name: str = "DEVICE") -> None: | CODE |
| LOW | backend/app/runtime_security.py | 93 | def _validate_directory_metadata(path: Path, metadata: os.stat_result) -> None: | CODE |
| LOW | backend/app/runtime_security.py | 107 | def _secure_open_fd_without_mode_change(path: Path, *, directory: bool) -> int: | CODE |
| LOW | backend/app/runtime_security.py | 179 | def ensure_model_cache_directory(path: Path | str) -> Path: | CODE |
| LOW | backend/app/runtime_security.py | 342 | def validate_model_cache_location( | CODE |
| LOW | backend/app/runtime_security.py | 441 | def _validate_sqlite_sidecar_metadata( | CODE |
| LOW | backend/app/runtime_security.py | 456 | def secure_sqlite_sidecar_file(path: Path | str) -> os.stat_result | None: | CODE |
| LOW | backend/app/runtime_security.py | 511 | def secure_sqlite_database_file(database_path: Path | str) -> None: | CODE |
| LOW | backend/app/runtime_security.py | 525 | def atomic_write_private_text(path: Path | str, content: str, *, encoding: str = "utf-8") -> None: | CODE |
| LOW | backend/app/runtime_security.py | 575 | def open_private_binary_exclusive(path: Path | str) -> BinaryIO: | CODE |
| LOW | backend/app/adapters/openai_translate.py | 244 | def write_preprocess_artifact(session: Path, pre: PreprocessResponse) -> Path: | CODE |
| LOW | backend/app/adapters/whisper_asr.py | 38 | def _remove_corrupt_whisper_cache(whisper, name: str, download_root: str | None) -> bool: | CODE |
| LOW | backend/app/adapters/ytdlp.py | 32 | def _bootstrap_bilibili_cookie(cookie_path: Path) -> None: | CODE |
| LOW | backend/app/adapters/ytdlp.py | 109 | def _download_with_format_candidates( | CODE |
| LOW | backend/app/adapters/ffmpeg.py | 228 | def subtitle_style_for_orientation(orientation: str, font: str, lang: str = "zh") -> str: | CODE |
| LOW | backend/app/adapters/voxcpm.py | 114 | def _write_original_target_audio( | CODE |
| LOW | backend/app/adapters/audio.py | 20 | def split_audio_by_translation(vocals_file: Path, translation_file: Path, session: Path) -> Path: | CODE |
| LOW | backend/app/adapters/openai_client.py | 6 | def normalize_openai_base_url(base_url: str) -> str: | CODE |
| LOW | backend/app/adapters/local_subtitles.py | 102 | def _uploaded_subtitle_payloads( | CODE |
| LOW⚡ | backend/app/adapters/local_subtitles.py | 135 | def write_uploaded_asr_artifact( | CODE |
| LOW⚡ | backend/app/adapters/local_subtitles.py | 144 | def write_uploaded_asr_fixed_artifact( | CODE |
| LOW⚡ | backend/app/adapters/local_subtitles.py | 153 | def write_uploaded_translation_artifact( | CODE |
| LOW | backend/app/adapters/local_subtitles.py | 165 | def write_uploaded_subtitle_artifacts( | CODE |
| LOW | backend/tests/test_voxcpm.py | 16 | def test_release_model_clears_cached_model(monkeypatch): | CODE |
| LOW | backend/tests/test_voxcpm.py | 51 | def test_fallback_cache_built_once_and_reused(mock_load, tmp_path): | CODE |
| LOW | backend/tests/test_voxcpm.py | 131 | def test_skips_existing_tts_files(mock_load, tmp_path): | CODE |
| LOW | backend/tests/test_voxcpm.py | 175 | def test_empty_translation_skips_tts(mock_load, tmp_path): | CODE |
| LOW | backend/tests/test_voxcpm.py | 192 | def test_original_mode_copies_original_audio_with_non_empty_caption(mock_load, tmp_path): | CODE |
| LOW | backend/tests/test_voxcpm.py | 246 | def test_legacy_empty_target_copies_original_audio_without_loading_model(mock_load, tmp_path): | CODE |
| LOW | backend/tests/test_voxcpm.py | 270 | def test_original_target_audio_writes_exact_private_range(tmp_path): | CODE |
| LOW | backend/tests/test_voxcpm.py | 292 | def test_original_target_audio_rejects_partially_out_of_range(tmp_path): | CODE |
| LOW | backend/tests/test_voxcpm.py | 312 | def test_original_target_audio_rejects_fully_out_of_range(tmp_path): | CODE |
| LOW | backend/tests/test_voxcpm.py | 332 | def test_original_target_audio_accepts_end_at_source_boundary(tmp_path): | CODE |
| LOW | backend/tests/test_voxcpm.py | 351 | def test_original_target_audio_accepts_sub_millisecond_rounded_tail(tmp_path): | CODE |
| LOW | backend/tests/test_voxcpm.py | 370 | def test_original_target_audio_rejects_one_millisecond_tail_overflow(tmp_path): | CODE |
| LOW | backend/tests/test_voxcpm.py | 390 | def test_original_target_audio_rejects_quantized_one_millisecond_tail_overflow( | CODE |
| LOW | backend/tests/test_voxcpm.py | 417 | def test_original_target_audio_rejects_symlink_output(tmp_path): | CODE |
| LOW | backend/tests/test_voxcpm.py | 439 | def test_original_segments_are_excluded_from_tts_fallback_references(mock_load, tmp_path): | CODE |
| LOW | backend/tests/test_voxcpm.py | 498 | def test_calls_progress_callback(mock_load, tmp_path): | CODE |
| LOW | backend/tests/test_voxcpm.py | 535 | def test_model_generate_used_for_own_reference(mock_load, tmp_path): | CODE |
| LOW | backend/tests/test_voxcpm.py | 567 | def test_fallback_cache_preserves_wrapper_generation_behavior(mock_load, tmp_path): | CODE |
| LOW | backend/tests/test_voxcpm.py | 603 | def test_fallback_cache_is_scoped_by_speaker(mock_load, tmp_path): | CODE |
| LOW | backend/tests/test_voxcpm.py | 667 | def test_fallback_keeps_same_speaker_when_only_other_speaker_has_long_reference(mock_load, tmp_path): | CODE |
| 296 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | backend/app/worker.py | 3 | CODE | |
| LOW | backend/app/auth.py | 1 | CODE | |
| LOW | backend/app/config.py | 1 | CODE | |
| LOW | backend/app/youtube.py | 1 | CODE | |
| LOW | backend/app/gpu_memory.py | 1 | CODE | |
| LOW | backend/app/database.py | 1 | CODE | |
| LOW | backend/app/stage_reset.py | 1 | CODE | |
| LOW | backend/app/runtime_checks.py | 1 | CODE | |
| LOW | backend/app/audio_mode.py | 1 | CODE | |
| LOW | backend/app/stages.py | 1 | CODE | |
| LOW | backend/app/sources.py | 1 | CODE | |
| LOW | backend/app/pipeline.py | 1 | CODE | |
| LOW | backend/app/main.py | 1 | CODE | |
| LOW | backend/app/devices.py | 1 | CODE | |
| LOW | backend/app/sanitize.py | 1 | CODE | |
| LOW | backend/app/runtime_security.py | 1 | CODE | |
| LOW | backend/app/adapters/asr_sentence_fixer.py | 1 | CODE | |
| LOW | backend/app/adapters/openai_translate.py | 1 | CODE | |
| LOW | backend/app/adapters/whisper_asr.py | 1 | CODE | |
| LOW | backend/app/adapters/ytdlp.py | 1 | CODE | |
| LOW | backend/app/adapters/ffmpeg.py | 1 | CODE | |
| LOW | backend/app/adapters/local_video.py | 1 | CODE | |
| LOW | backend/app/adapters/voxcpm.py | 1 | CODE | |
| LOW | backend/app/adapters/demucs.py | 1 | CODE | |
| LOW | backend/app/adapters/audio.py | 1 | CODE | |
| LOW | backend/app/adapters/openai_client.py | 1 | CODE | |
| LOW | backend/app/adapters/_translate_prompts.py | 1 | CODE | |
| LOW | backend/app/adapters/local_subtitles.py | 1 | CODE | |
| LOW | backend/tests/test_voxcpm.py | 1 | CODE | |
| LOW | backend/tests/conftest.py | 1 | CODE | |
| LOW | backend/tests/test_stage_reset.py | 1 | CODE | |
| LOW | backend/tests/test_stage_reset.py | 3 | CODE | |
| LOW | backend/tests/test_settings_and_api.py | 1 | CODE | |
| LOW | backend/tests/test_auth.py | 1 | CODE | |
| LOW | backend/tests/test_auth.py | 4 | CODE | |
| LOW | backend/tests/test_audio.py | 1 | CODE | |
| LOW | backend/tests/test_local_subtitles.py | 1 | CODE | |
| LOW | backend/tests/test_file_permissions.py | 1 | CODE | |
| LOW | backend/tests/test_demucs_adapter.py | 1 | CODE | |
| LOW | backend/tests/test_whisper_asr.py | 1 | CODE | |
| LOW | backend/tests/test_worker.py | 1 | CODE | |
| LOW | backend/tests/test_gpu_memory.py | 1 | CODE | |
| LOW | backend/tests/test_audio_mode.py | 1 | CODE | |
| LOW | backend/tests/test_config.py | 1 | CODE | |
| LOW | backend/tests/test_runtime_checks.py | 1 | CODE | |
| LOW | backend/tests/test_devices.py | 1 | CODE | |
| LOW | backend/tests/test_local_video.py | 1 | CODE | |
| LOW | backend/tests/test_asr_sentence_fixer.py | 1 | CODE | |
| LOW | backend/tests/test_ffmpeg.py | 1 | CODE | |
| LOW | backend/tests/test_translation.py | 1 | CODE | |
| LOW | backend/tests/test_pipeline.py | 1 | CODE | |
| LOW | scripts/run_pipeline.py | 3 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | backend/app/worker.py | 40 | except Exception: | CODE |
| LOW | backend/app/worker.py | 52 | except Exception: | CODE |
| LOW⚡ | backend/app/worker.py | 71 | except Exception: | CODE |
| LOW⚡ | backend/app/worker.py | 76 | except Exception: | CODE |
| LOW⚡ | backend/app/worker.py | 85 | except Exception as exc: | CODE |
| LOW⚡ | backend/app/worker.py | 93 | except Exception: | CODE |
| LOW | backend/app/gpu_memory.py | 106 | except Exception as exc: | CODE |
| LOW | backend/app/database.py | 42 | except Exception: | CODE |
| LOW | backend/app/pipeline.py | 129 | except Exception as exc: | CODE |
| LOW⚡ | backend/app/pipeline.py | 252 | except Exception as stage_exc: | CODE |
| LOW⚡ | backend/app/pipeline.py | 255 | except Exception as release_exc: | CODE |
| LOW⚡ | backend/app/pipeline.py | 265 | except Exception as release_exc: | CODE |
| LOW | backend/app/pipeline.py | 306 | except Exception as log_exc: | CODE |
| LOW⚡ | backend/app/pipeline.py | 319 | except Exception: | CODE |
| LOW⚡ | backend/app/pipeline.py | 334 | except Exception: | CODE |
| LOW⚡ | backend/app/pipeline.py | 596 | except Exception as task_exc: | CODE |
| LOW⚡ | backend/app/pipeline.py | 599 | except Exception as release_exc: | CODE |
| LOW⚡ | backend/app/pipeline.py | 609 | except Exception as release_exc: | CODE |
| LOW⚡ | backend/app/pipeline.py | 612 | except Exception as task_read_exc: | CODE |
| LOW | backend/app/pipeline.py | 628 | except Exception as task_update_exc: | CODE |
| LOW | backend/app/main.py | 401 | except Exception: | CODE |
| LOW | backend/app/main.py | 423 | except Exception: | CODE |
| LOW | backend/app/main.py | 427 | except Exception: | CODE |
| LOW | backend/app/main.py | 482 | except Exception: | CODE |
| LOW | backend/app/main.py | 726 | except Exception as exc: | CODE |
| MEDIUM | backend/app/main.py | 311 | def _ensure_runtime_ready() -> None: | CODE |
| LOW | backend/app/runtime_security.py | 123 | except Exception: | CODE |
| LOW | backend/app/runtime_security.py | 136 | except Exception: | CODE |
| LOW | backend/app/runtime_security.py | 570 | except Exception: | CODE |
| LOW | backend/app/runtime_security.py | 586 | except Exception: | CODE |
| LOW | backend/app/adapters/ytdlp.py | 126 | except Exception as exc: | CODE |
| LOW | backend/app/adapters/ffmpeg.py | 323 | except Exception: | CODE |
| MEDIUM | backend/tests/test_settings_and_api.py | 1062 | def update_settings() -> None: | CODE |
| MEDIUM | backend/tests/test_settings_and_api.py | 1141 | def read_settings() -> None: | CODE |
| LOW | backend/tests/test_settings_and_api.py | 1070 | except Exception as exc: # pragma: no cover - asserted below | CODE |
| LOW | backend/tests/test_settings_and_api.py | 1144 | except Exception as exc: # pragma: no cover - asserted below | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | backend/app/worker.py | 17 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | backend/app/database.py | 658 | def update_task(task_id: str, **fields: Any) -> None: | CODE |
| LOW⚡ | backend/app/database.py | 667 | def update_stage(task_id: str, name: str, **fields: Any) -> None: | CODE |
| LOW⚡ | backend/app/database.py | 676 | def set_setting(key: str, value: str) -> None: | CODE |
| LOW | backend/app/pipeline.py | 20 | logger = logging.getLogger(__name__) | CODE |
| LOW | backend/app/main.py | 39 | logger = logging.getLogger(__name__) | CODE |
| LOW | backend/tests/test_settings_and_api.py | 1062 | def update_settings() -> None: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | backend/app/adapters/openai_translate.py | 84 | except json.JSONDecodeError: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | backend/app/main.py | 387 | CODE | |
| LOW | backend/app/runtime_security.py | 179 | CODE | |
| LOW | backend/app/adapters/voxcpm.py | 168 | CODE | |
| LOW | backend/tests/test_pipeline.py | 682 | CODE | |
| LOW | backend/tests/test_pipeline.py | 693 | CODE | |
| LOW | backend/tests/test_pipeline.py | 694 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | backend/app/pipeline.py | 592 | def run_task(task_id: str) -> None: | CODE |